Pundit scopes + Inherited Resources

Administrator
2014-04-24T17:29:30+02:00

*Created by: onemanstartup*

Hi. I took your code and slightly modified, please look at this.
I needed to use additional scope for collection after it was authorized, so only method i came up is path inherited resources.
One problem is verification of policies don't work yet. What do you think about this approach? Can be it done differently or not at all? It seems odd for me to keep all scopes in policies.

``` ruby
module Accessable
module ::InheritedResources
module BaseHelpers
def end_of_association_chain
if association_chain.is_a?(ActiveRecord::Relation)
apply_scopes_if_available(association_chain)
elsif chain = association_chain.last
if method_for_association_chain
apply_scopes_if_available(chain.send(method_for_association_chain))
else
chain
end
else
apply_scopes_if_available(resource_class)
end
end
end
end

def self.included base
base.send :include, Pundit
base.class_eval do
before_filter :authorize_resource

def policy_scope scope
Pundit.policy_scope!(current_user, scope)
end

def policy record
Pundit.policy!(current_user, record)
end
end
end

protected

# Authorize resource, see Policies.
def authorize_resource
case action_name
when build_resources_authorized
authorize controlled_access_build_resource
when resources_authorized
authorize controlled_access_resource
when collection_authorized
@association_chain = policy_scope(resource_class)
else
authorize resource_class
end
end

private

def controlled_access_collection c
policy_scope c
end

def collection_authorized
/index/
end

def build_resources_authorized
/new|create/
end

def resources_authorized
/edit|update|show|destroy/
end

def controlled_access_build_resource
return build_resource if respond_to?(:build_resource)
resource_class.new params[resource_class.to_s.to_sym]
end

def controlled_access_resource
return resource if respond_to?(:resource)
resource_class.find(params[:id])
end
end
```

``` ruby

class ArticlesController < InheritedResources::Base
include Accessable
# after_action :verify_policy_scoped, :only => :index
respond_to :html
respond_to :rss, only: :index

protected

def collection
@articles ||= end_of_association_chain.page(params[:page]).per(10).order(:id)
end

def build_resource_params
[params.fetch(resource_instance_name, {}).permit(:title, :short_description, :body, :tag_list, :meta_description, :meta_keywords, :meta_title)]
end
end
```